Agape Recovery Privacy Policy
Agape has a practice of protecting the privacy and security of Person Served, supplier and Personnel records. Agape is committed to meeting obligations under Canadian data privacy laws, including the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”) and the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A (the “PHIPA”). Agape adheres to the privacy principles set out below, which govern the way it collects, uses, stores and discloses personal information that is obtained in the course of development, sales, promotion and distribution of our products or in the course of employment. Agape will collect, use, store and disclose personal information in accordance with the following privacy policy.
Definitions
For purposes of this policy, the following definitions apply:
- “Disclose” has the meaning ascribed to it in the PHIPA.
- “Health information custodian” has the meaning ascribed to it in the PHIPA.
- “Personal information” means any information about an identifiable person, including Personnel records, and Person Served data, personal health information, and supplier information, but does not include the name, title, business address, business telephone number, business fax number or business e-mail address of Agape Personnel.
- “Personal health information” has the meaning ascribed to it in the PHIPA.
- “Use” has the meaning ascribed to it in the PHIPA.
Accountability and General Principles
The overall responsibility for ensuring compliance with data privacy laws and this privacy policy rests with Agape’s Managing Director, who is the Privacy Officer, although other individuals within Agape have responsibility for the day-to-day collection and processing of personal information and may be delegated to act on behalf of the Privacy Officer. Agape is responsible for personal information in its possession or custody, including personal information that it may transfer to third parties for processing. Agape will require its service providers to agree to contractual requirements that are consistent with our privacy and security policies. Agape will require that its service providers are prohibited from using personal information, except for the specific purpose for which we supply it to them.
The following guidelines describe key principles Agape is committed to for safeguarding the privacy and confidentiality of personal information:
- Collecting only the personal information that may be necessary for the treatment and care of Persons Served.
- Implementing safeguards surrounding all personal information in Agape’s possession.
- Sharing information with other health care providers and organizations on a “need to know” basis where required for the treatment of Persons Served or authorized by Applicable Law.
- Disclosing information to third parties who are not health information custodians only with the expressed consent of Persons Served or when permitted by Applicable Law.
- Keeping accurate and up-to-date records and medical information.
- Retaining and destroying records and personal information in accordance with Applicable Law.
Identifying Purposes
Either before or at the time of collection, Agape will identify the purposes for which it plans to use the personal information. Depending upon the way in which the personal information is collected, this can be done orally or in writing. Agape may use the personal information it collects for the following enumerated purposes:
- to provide services or treatment to Persons Served;
- to provide Persons Served access to Agape’s Premises;
- to respond to client inquiries about accounts and other services;
- to understand client and prospective client needs and to offer products and services to meet those needs;
- to conduct background checks on Persons Served or prospective Persons Served; and
- to meet legal requirements.
Unless required by law, Agape will not use personal information for a new purpose without the knowledge and consent of the individual to whom the information relates. If the information being obtained, stored, gathered, or disclosed is personal health information, then Agape shall only use or disclose the information for the following purposes:
- Any other permissible uses under PHIPA
Consent
Personal information will only be collected, used or disclosed with the consent of the individual, except in certain circumstances permitted or required by Applicable Law. The way in which Agape seeks consent may vary depending upon the sensitivity of the information. Agape will obtain consent in all cases where the personal information involved is considered sensitive, such as income or personal health information. Typically, Agape will seek consent for the use or disclosure of personal information at the time of collection. However, additional consent will be sought after the personal information has been collected if it is required for a new purpose. In certain circumstances where obtaining consent would be inappropriate or impossible, Agape may obtain, use or disclose personal information without obtaining consent to the extent permitted by Applicable Law.
Limiting Collection, Use, Disclosure and Retention
Agape will collect personal information by fair and lawful means and will limit the amount and type of personal information Agape collects to that which is necessary for its identified purposes. Personal information will be retained for three (3) years and will be stored in a locked storage facility on Agape Premises or virtually on a secured database. Only the Program Director and Privacy Officer have access to the locked storage facility in which the personal information records are being retained. After three (3) years, the personal information will be destroyed in a secure manner and in accordance with applicable privacy legislation. Upon the resignation, retirement or termination of Personnel, the Personnel’s personal information will be destroyed in a secure manner and in accordance with applicable privacy legislation.
Agape will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Agape will not sell and/or trade customer lists to selected third-party companies and organizations that meet its for security and confidentiality requirements. These lists will not include any personal information and do not include credit or transaction information. Subject to any applicable business, legal, or regulatory requirements, Agape will ensure that the data is destroyed in a secure manner, erased or made anonymous.
Agape may provide personal information to affiliates. Agape’s affiliates are the family of companies that form our parent company and any/all sister companies.
Agape will use best efforts to ensure that personal information that is used on an ongoing basis and information that is used to make a decision about an individual is as accurate, complete and up-to-date as necessary for the purpose for which it is to be used.
Agape will protect personal information with safeguards appropriate to the level of sensitivity of the information. Agape safeguards protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which the information is held. Agape will exercise care in the disposal or destruction of personal information to prevent unauthorized parties from gaining access to the information. Agape’s methods of protection include physical measures (e.g., locked file storage and restricted access to offices), organizational measures (e.g., security clearances and limiting access on a need-to-know basis) and technological measures (e.g., the use of passwords and encryption). All computer systems are password-secured and constructed in such a way that only authorized individuals can access secure systems and databases. Agape also requires its outside service providers to provide a comparable level of protection to personal information that is supplied to them.
Individual Access
Upon written request, Agape will inform an individual of the existence, use and disclose of their personal information and give them reasonable access to that information. Agape may deny access for legally permissible reasons, such as situations where the information is prohibitively costly to provide, if it contains references to other individuals, or where it cannot be disclosed for legal, security or commercial proprietary reasons. Agape will advise the individual of any reason for denying an access request and shall provide written reasons for the decision. When an individual successfully demonstrates the inaccuracy or incompleteness of personal information held by Agape, Agape will correct or update the information as required.
Filing Inquiries and Complaints
Agape will investigate all written complaints and respond to all written inquiries. If Agape finds a complaint to be justified, the organization will take appropriate measures to resolve it. To file an opt-out request, request access to personal information, report incorrect information or file a complaint, written requests may be submitted according to the grievance process outlined in the intake process.
This privacy policy shall be publicly available to all Personnel, Persons Served, and potential clients, and shall be explained during the orientation process for all individuals working for or receiving services from Agape.